Agent skill
secrets-vault-manager
Handle SOPS + Age secrets for ONE_SHOT projects. Manages encrypted secrets, decryption, and secret rotation. Use when user mentions 'secrets', 'API keys', 'environment variables', '.env', or 'SOPS'.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/secrets-vault-manager
SKILL.md
Secrets Vault Manager
You are an expert at managing secrets with SOPS + Age encryption.
When To Use
- Project needs API keys / secrets
- User mentions "Set up secrets-vault"
- User asks to "Decrypt / refresh secrets"
- User wants to "Add a new secret"
Philosophy
One Age key in 1Password → ALL secrets.
Setup (One-Time)
# Install
sudo apt install age sops # Ubuntu
brew install age sops # Mac
# Generate key
mkdir -p ~/.age
age-keygen -o ~/.age/key.txt
# Save public key (age1...) to 1Password
# Secrets are in the oneshot repo
# If not cloned: git clone [email protected]:Khamel83/oneshot.git ~/github/oneshot
Create .sops.yaml
creation_rules:
- path_regex: .*\.encrypted$
age: 'age1your_public_key_here'
Daily Usage
# Decrypt to project
sops --decrypt ~/github/oneshot/secrets/secrets.env.encrypted > .env
source .env
# Update secrets
sops ~/github/oneshot/secrets/secrets.env.encrypted
# Edit, save, auto-encrypted
cd ~/github/oneshot && git add . && git commit -m "Update secrets" && git push
Common Operations
Decrypt for Local Use
sops --decrypt ~/github/oneshot/secrets/secrets.env.encrypted > .env
Verify .env is gitignored!
Add New Secret
sops ~/github/oneshot/secrets/secrets.env.encrypted
# Add: NEW_SECRET=value
# Save and exit
cd ~/github/oneshot && git add . && git commit -m "Add NEW_SECRET" && git push
Refresh Secrets
sops --decrypt ~/github/oneshot/secrets/secrets.env.encrypted > .env
Per-Project SOPS (Alternative)
If not using central vault:
mkdir -p .sops
age-keygen -o .sops/key.txt
cat > .sops.yaml << 'EOF'
creation_rules:
- path_regex: \.encrypted$
age: 'age1your_key'
EOF
sops secrets.env.encrypted
sops --decrypt secrets.env.encrypted > .env
.gitignore Template
# Secrets (NEVER commit)
.env
.env.local
secrets.env
*.key
key.txt
.age/
# Allow examples
!.env.example
# SOPS encrypted ARE safe
!*.encrypted
Document in README
Add to project README:
## Secrets
This project uses SOPS + Age for secrets management.
\`\`\`bash
# Decrypt secrets (requires Age key)
sops --decrypt ~/github/oneshot/secrets/secrets.env.encrypted > .env
source .env
\`\`\`
Outputs
.envcreated or refreshed (gitignored)- Documentation updated: README "Secrets" section
secrets.env.encryptedupdated in vault when adding new secrets
Anti-Patterns
- Ever committing
.envor raw secrets - Decrypting into tracked files
- Sharing Age private key outside 1Password
- Storing secrets in code or comments
Related Skills
secrets-sync: Two-way sync between vault and projects, namespacing, project labels
Keywords
secrets, API keys, environment variables, .env, SOPS, Age, encrypt, decrypt, vault
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?